Gitlabs: Prasaga, HE2B, and Kombinat targeted by fog ransomware group

• Ransomware group: fog
• Country: United States
• Sector: Technology
• Announcement date: January 29, 2025

Fog ransomware group claims Gitlab source code leak

The threat actor known as fog has listed alleged source code belonging to Prasaga, HE2B, and Kombinat on its leak site. This announcement, made on January 29, 2025, suggests a targeted operation aimed at extracting sensitive development assets from these entities.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data but also threaten to publish it publicly to cause maximum reputational and operational damage. By hosting stolen data on a public platform, the threat actor increases the visibility of the breach, potentially exposing the victim to regulatory scrutiny and loss of client trust.

Details of the alleged attack

According to an announcement published on January 29, 2025, the fog group claims to have obtained Gitlab source code belonging to Prasaga, HE2B, and Kombinat. The post includes torrent links for each entity, with each stated to be 1 GB in size. This specific type of data theft is particularly damaging as it targets the core intellectual property of a technology organization.

The threat actor did not stop at the current victims; the group also listed Propulsion Academy AG, X-Pans, and Professional Computer Co., Ltd. as potential future targets. This tactic is common among ransomware operators to instill fear in other organizations within the same sector or those with similar digital footprints, serving as a warning of what may happen if they do not comply with demands.

Data involved in the leak

The leak allegedly contains source code belonging to Prasaga, HE2B, and Kombinat. Based on the provided screenshots, 1 GB of data is associated with each of these entities. The specific types of data identified in the listing include:

• Source code

While the total claimed data size is 3 GB, the specific file counts were not provided in the announcement.

Impact and security implications

This alleged leak may pose risks to the intellectual property and software security of the affected entities. The exposure of source code could lead to the exploitation of vulnerabilities within the organizations' systems by malicious actors. When attackers gain access to the underlying logic of an application, they can identify flaws that were previously hidden, facilitating more sophisticated and targeted subsequent attacks.

For US-based entities, this could result in the loss of trade secrets and potential competitive disadvantages. Furthermore, if the leaked data contains sensitive configuration details or API keys, the risk of secondary attacks may increase. The loss of such credentials can allow attackers to move laterally through a network or access cloud environments, turning a single breach into a widespread systemic failure.

Defensive measures and considerations

Organizations in the technology sector can take several steps to mitigate the risks associated with source code exposure. Implementing strict access controls and multi-factor authentication for all development environments is a fundamental requirement. Additionally, organizations should employ robust monitoring and logging to detect unauthorized access to sensitive repositories like Gitlab.

Regularly auditing code for hardcoded secrets, such as API keys or passwords, is another critical defensive step. If a breach occurs, rapid incident response and a clear communication strategy are essential to manage the fallout. It is important to note that information about the fog group remains limited, making it difficult to attribute the attack or predict the group's specific methodologies.